Chattanooga 24x7x365 Emergency CryptoLocker
Computer Virus Assessment and Recovery Services

Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyberplague that represents an extinction-level threat for businesses unprepared for an assault. Different versions of ransomware like the Dharma, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for many years and continue to cause harm. The latest strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with more as yet unnamed viruses, not only encrypt online files but also infiltrate all configured system protection mechanisms. Information synched to cloud environments can also be encrypted. In a vulnerable data protection solution, this can make automated restore operations useless and effectively knocks the entire system back to zero.

Getting back online services and information following a crypto-ransomware event becomes a race against the clock as the victim tries its best to contain, remove the virus, and restore business-critical operations. Because ransomware needs time to replicate, penetrations are usually sprung on weekends and holidays, when successful attacks tend to take longer to detect. This compounds the difficulty of quickly marshalling and coordinating a capable response team.

Progent has a range of solutions for protecting enterprises from ransomware events. Among these are staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of next-generation security appliances with AI technology from SentinelOne to detect and extinguish day-zero cyber threats quickly. Progent also provides the services of seasoned crypto-ransomware recovery professionals with the track record and commitment to re-deploy a compromised environment as urgently as possible.

Progent's Ransomware Restoration Services
Soon after a ransomware penetration, even paying the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the codes to unencrypt any or all of your data. Kaspersky determined that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to re-install the key components of your Information Technology environment. Without the availability of complete information backups, this requires a wide range of skill sets, well-coordinated project management, and the capability to work continuously until the recovery project is done.

For two decades, Progent has provided certified expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial systems and ERP software solutions. This breadth of experience provides Progent the capability to efficiently ascertain critical systems and integrate the remaining components of your network environment following a ransomware event and assemble them into an operational network.

Progent's recovery group uses state-of-the-art project management applications to orchestrate the complicated recovery process. Progent understands the importance of working swiftly and in unison with a customer's management and IT staff to prioritize tasks and to put critical systems back online as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Incident Response
A client engaged Progent after their company was crashed by the Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored cybercriminals, suspected of using strategies leaked from the United States NSA organization. Ryuk goes after specific organizations with little room for disruption and is one of the most lucrative iterations of ransomware malware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in the Chicago metro area with around 500 staff members. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the time of the attack and were destroyed. The client was taking steps for paying the ransom (in excess of $200,000) and wishfully thinking for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to quickly identify and prioritize the mission critical applications that had to be recovered to make it possible to resume business functions:

• Microsoft Active Directory
• Microsoft Exchange Email
• Financials/MRP

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then completed reinstallations and storage recovery on mission critical applications. All Microsoft Exchange Server schema and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble intact OST files (Outlook Off-Line Data Files) on staff desktop computers and laptops to recover mail information. A recent offline backup of the customer's accounting/MRP software made them able to recover these vital programs back available to users. Although major work remained to recover fully from the Ryuk virus, the most important systems were restored quickly:

Throughout the next month important milestones in the recovery process were completed in tight cooperation between Progent engineers and the customer:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Server with over 4 million archived emails was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/AP/AR/Inventory modules were fully restored.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Nearly all of the user desktops and notebooks were back into operation.

Conclusion
A probable business-killing disaster was evaded by hard-working experts, a broad array of technical expertise, and tight teamwork. Although in post mortem the ransomware attack detailed here should have been identified and stopped with up-to-date security solutions and best practices, team training, and well thought out security procedures for backup and applying software patches, the reality is that government-sponsored hackers from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has substantial experience in ransomware virus blocking, mitigation, and file disaster recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Chattanooga a variety of online monitoring and security assessment services designed to assist you to minimize the threat from ransomware. These services incorporate modern machine learning technology to detect new strains of ransomware that can get past traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the daily monitoring and management for you, so your network scales easily without holding you back. For an affordable and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Basic plans include remote monitoring and management (RMM), cybersecurity, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management technology to help keep your IT system operating efficiently by tracking the health of vital assets that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is transmitted automatically to your designated IT management personnel and your assigned Progent engineering consultant so any potential problems can be resolved before they can disrupt your network. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for monitoring and managing your network, server, and desktop devices by providing tools for performing common time-consuming tasks. These include health monitoring, update management, automated remediation, endpoint deployment, backup and restore, anti-virus defense, remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your specified IT management staff and your Progent technical consultant so that potential issues can be taken care of before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for smaller businesses to map out, monitor, enhance and troubleshoot their connectivity hardware such as routers, firewalls, and access points as well as servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology maps are always current, captures and displays the configuration information of almost all devices connected to your network, monitors performance, and generates alerts when problems are discovered. By automating complex management and troubleshooting activities, ProSight WAN Watch can knock hours off common chores like making network diagrams, reconfiguring your network, finding appliances that need critical software patches, or isolating performance problems. Learn more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting utilities created to work with the top ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-up or endpoints with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with advanced backup technology companies to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based management outsourcing plans that provide backup-as-a-service. ProSight DPS products automate and track your backup processes and allow transparent backup and fast recovery of important files, applications, system images, and VMs. ProSight DPS lets you recover from data loss caused by hardware failures, natural calamities, fire, malware like ransomware, human error, malicious insiders, or software bugs. Managed backup services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of top information security companies to provide web-based control and comprehensive protection for all your email traffic. The hybrid architecture of Email Guard integrates cloud-based filtering with an on-premises gateway device to provide complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. The Cloud Protection Layer serves as a first line of defense and blocks most unwanted email from reaching your security perimeter. This reduces your exposure to external threats and conserves system bandwidth and storage space. Email Guard's onsite gateway appliance adds a further level of inspection for incoming email. For outbound email, the local security gateway offers anti-virus and anti-spam protection, DLP, and email encryption. The local gateway can also assist Microsoft Exchange Server to track and protect internal email traffic that originates and ends inside your security perimeter. For more details, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo supports single-tap identity verification with Apple iOS, Android, and other out-of-band devices. With 2FA, whenever you sign into a secured online account and enter your password you are asked to confirm who you are on a device that only you possess and that uses a different network channel. A broad range of devices can be used as this added form of ID validation including an iPhone or Android or watch, a hardware token, a landline phone, etc. You may register multiple validation devices. To find out more about ProSight Duo identity validation services, visit Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Support Desk services permit your information technology group to offload Call Center services to Progent or divide activity for Service Desk support seamlessly between your in-house network support staff and Progent's extensive pool of IT service engineers and subject matter experts. Progent's Shared Help Desk Service offers a seamless supplement to your in-house network support team. User access to the Help Desk, provision of technical assistance, issue escalation, ticket generation and tracking, performance measurement, and management of the service database are consistent regardless of whether incidents are taken care of by your corporate network support resources, by Progent, or a mix of the two. Learn more about Progent's outsourced/shared Call Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior machine learning technology to guard endpoints and physical and virtual servers against modern malware attacks like ransomware and email phishing, which routinely evade traditional signature-based AV tools. Progent Active Security Monitoring services protect local and cloud resources and provides a single platform to automate the entire malware attack progression including protection, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and protect information about your IT infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or warranties. By updating and managing your IT documentation, you can save as much as half of time wasted looking for critical information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and associating IT data. Whether you're planning enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you need when you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide businesses of all sizes a versatile and affordable solution for assessing, validating, scheduling, applying, and tracking updates to your ever-evolving IT network. Besides maximizing the security and functionality of your computer network, Progent's software/firmware update management services allow your IT team to focus on line-of-business projects and tasks that deliver the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected Tier III data center on a high-performance virtual host configured and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the customer owns the data, the OS platforms, and the apps. Since the environment is virtualized, it can be ported easily to an alternate hardware environment without requiring a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior machine learning tools to defend physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily escape legacy signature-matching anti-virus products. ProSight ASM protects local and cloud resources and offers a single platform to address the complete malware attack lifecycle including protection, identification, mitigation, cleanup, and forensics. Key capabilities include single-click rollback using Windows VSS and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer economical in-depth security for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, device control, and web filtering via leading-edge technologies incorporated within a single agent managed from a single console. Progent's security and virtualization experts can assist your business to plan and implement a ProSight ESP environment that addresses your company's specific requirements and that helps you achieve and demonstrate compliance with legal and industry data security regulations. Progent will help you define and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent can also assist you to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.